[ftechuk]

When we started building a few Joomla sites, they got hacked regulary at the start till we hardened the server and tightened up permissions.

Backup your site. FTP into your public_html folder and sort the files by date order. This will show you the newest files in there or the when the files where last changed. You should go through every directory as you never know how deep into the folder structure the hack goes. Look for new files/files that have been changed recently. Apart from the index.php page which you say you have changed, if you havent installed anything new, any new files will be part of the hack. Delete them, replace your index.php again, then get someone who knows how to harden up your server/site to do it.

Just a thought, but check any image folders first, usually these have write permissions on them and thats how the hackers get in.